Bug 455030

Description of problem:

While closing some 3D application - Xorg server goes down with the application
as well.

Here is backtrace from the gdb.

Program received signal SIGSEGV, Segmentation fault.
__glXDeassociateContext (glxc=0x9fed80) at glxutil.c:80
80		      ; prev = curr, curr = curr->nextDrawPriv ) {
(gdb) bt
#0  __glXDeassociateContext (glxc=0x9fed80) at glxutil.c:80
#1  0x00007f8767c3863f in __glXContextDestroy (context=0x11628c0)
    at glxcmds.c:151
#2  0x00007f8767c44712 in __glXDRIcontextDestroy (baseContext=0x9fed80)
    at glxdri.c:304
#3  0x00007f8767c3a7e2 in __glXFreeContext (cx=0x9fed80) at glxext.c:140
#4  0x00007f8767c3a823 in ContextGone (cx=0x11628c0, id=1161030104)
    at glxext.c:98
#5  0x000000000042ea45 in FreeResourceByType (id=8388609, type=52, skipFree=0)
    at resource.c:597
#6  0x00007f8767c3712e in __glXDisp_DestroyContext (cl=<value optimized out>, 
    pc=<value optimized out>) at glxcmds.c:338
#7  0x00007f8767c3aaf2 in __glXDispatch (client=0xc93530) at glxext.c:492
#8  0x00000000004467d4 in Dispatch () at dispatch.c:454
#9  0x000000000042cc4d in main (argc=3, argv=0x7fff702c7588, 
    envp=<value optimized out>) at main.c:441



(gdb) print curr
$1 = (__GLXcontext *) 0xa0000000a

Obviously invalid address.

(gdb) print *glxc
$4 = {destroy = 0x7f8767c446d0 <__glXDRIcontextDestroy>, 
  makeCurrent = 0x7f8767c42b60 <__glXDRIcontextMakeCurrent>, 
  loseCurrent = 0x7f8767c42b90 <__glXDRIcontextLoseCurrent>, 
  copy = 0x7f8767c42bb0 <__glXDRIcontextCopy>, 
  forceCurrent = 0x7f8767c42bd0 <__glXDRIcontextForceCurrent>, 
  textureFromPixmap = 0x7f8767e68ce0, last = 0x0, next = 0x0, 
  nextDrawPriv = 0x0, nextReadPriv = 0x0, config = 0xa6a050, 
  pGlxScreen = 0xa66620, id = 8388609, share_id = 0, screen = 0, 
  idExists = 0 '\0', isCurrent = 0 '\0', isDirect = 0 '\0', 
  hasUnflushedCommands = 0 '\0', renderMode = 7168, feedbackBuf = 0x0, 
  feedbackBufSize = 0, selectBuf = 0x0, selectBufSize = 0, 
  drawPriv = 0x11628c0, readPriv = 0x11628c0}

(gdb) print *glxc->drawPriv->drawGlxc 
$7 = {destroy = 0xb000600060000, makeCurrent = 0x4e5f594c00000002, 
  loseCurrent = 0xda4f44, copy = 0xb000600060000, 
  forceCurrent = 0x654d004500000002, textureFromPixmap = 0xda4f78, 
  last = 0xb000600060000, next = 0x414e5f4800000002, nextDrawPriv = 0xda4fac, 
  nextReadPriv = 0xb000600060000, config = 0x5954535f00000002, 
  pGlxScreen = 0xda4fe0, id = 393216, share_id = 720902, screen = 2, 
  idExists = 80 'P', isCurrent = 79 'O', isDirect = 73 'I', 
  hasUnflushedCommands = 78 'N', renderMode = 14307348, 
  feedbackBuf = 0xb000600060000, feedbackBufSize = 2, selectBuf = 0xda5048, 
  selectBufSize = 393216, drawPriv = 0x4152455600000002, readPriv = 0xda507c}

(gdb) print glxc->drawPriv->drawGlxc->nextDrawPriv->nextDrawPriv 
$9 = (__GLXcontext *) 0xa0000000a
(gdb) print *glxc->drawPriv->drawGlxc->nextDrawPriv
$10 = {destroy = 0, makeCurrent = 0xa0000000a, loseCurrent = 0xa, copy = 0, 
  forceCurrent = 0, textureFromPixmap = 0x0, last = 0x0, next = 0x0, 
  nextDrawPriv = 0xa0000000a, nextReadPriv = 0xa0000001f, 
  config = 0xa0000001f, pGlxScreen = 0xa, id = 0, share_id = 0, screen = 0, 
  idExists = 0 '\0', isCurrent = 0 '\0', isDirect = 0 '\0', 
  hasUnflushedCommands = 0 '\0', renderMode = 4, feedbackBuf = 0x500000005, 
  feedbackBufSize = 14, selectBuf = 0xf00000014, selectBufSize = 4, 
  drawPriv = 0x0, readPriv = 0x1200000000}

So this seems to be showing some weird place in the memory


Version-Release number of selected component (if applicable):
xorg-x11-server-Xorg-1.4.99.905-2.20080701.fc10.x86_64


How reproducible:


Steps to Reproduce:
1. closing 3D application - I assume easily repeatable on my box.
2.
3.
  
Actual results:


Expected results:


Additional info: